ruby {
code => '
a = event.get("files")
a.each_index { |i|
event.set("files-#{i}-total", a[i]["MD5"])
}
'
}
This solution produces new objects for each MD5, I could kind of use it and merge the values after extracing it from Logstash, but I want to close my solution within Logstash configuration.

[2018-10-10T15:48:18,431][ERROR][logstash.filters.ruby ] Ruby exception occurred: undefined method `map' for nil:NilClass --> caused probably by the attempt to parse something that does contain "files", but does not contain "files":[{"MD5"}]
[2018-10-10T15:47:51,820][ERROR][logstash.filters.ruby ] Ruby exception occurred: no implicit conversion of String into Integer --> I do not know yet from where does it coming from.